PHP2Shell Shield v1.4.0

Stronger, advisory-complete mitigations (closing the gaps from an honest review against the published PHP2Shell advisories).

New

• fatal_error_backtraces=0 on PHP 8.5 — the advisory's 8.5-specific hardening (Sophos).
• post_max_size=32M — caps request size to shrink the out-of-memory attack surface. Applied only when your current limit is higher (never raised), and reversible with the shield.
• Host-level hardened snippet — the Manual snippet now also offers the php_admin_value / PHP-FPM-pool / Apache form that applications cannot override at runtime, alongside the auto form, with a plain note on the difference. (A plugin cannot write that form itself, so it is offered for your host.)

Under the hood

• Pack updated to 1.1.0 (re-signed); the map is resolved for your PHP branch and current post_max_size, then snapshotted so the displayed and re-applied settings stay consistent.

No change to the two headline settings (memory_limit=-1, session.upload_progress.enabled=0). Still a shield, not a cure — update PHP to a fixed version when you can.

---

Built by AbodyStudio · support@abodystudio.com